Credentials from Password Stores - Keychain

Title: Credentials from Password Stores - Keychain
Status: test
Description:Detects passwords dumps from Keychain
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.001/T1555.001.md
  -https://gist.github.com/Capybara/6228955
Author: Tim Ismilyaev, oscd.community, Florian Roth (Nextron Systems)
Date: 2020-10-19
modified:2021-11-27
Tags:

• -'attack.credential-access'
• -'attack.t1555.001'

Logsource:

• category: process_creation
• product: macos

Detection:
  selection1:
    Image: '/usr/bin/security'
    CommandLine|contains:
      -'find-certificate'
      -' export '

  selection2:
    CommandLine|contains:
      -' dump-keychain '
      -' login-keychain '

  condition:1 of selection*
Falsepositives:
  -Legitimate administration activities
Level: medium